Data Processing Agreement

CIQRA OÜ · Version 2.8 · Last updated: 3 November 2026

Effective date for existing customers: the changes in this version take effect, for a customer who accepted an earlier version, on the date stated in CIQRA's notice of this version, at least 30 days after the notice (Terms of Service, Section 14.2); until then the earlier version applies to that customer. A customer that objects may terminate without charge before that date (Terms of Service, Section 14.3).

This Data Processing Agreement ("DPA") forms part of the Terms of Service and the Merchant Agreement between CIQRA and each Merchant, and sets out the terms required by Article 28 of the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"). It is CIQRA's single data-processing agreement for every country: Section 14 and Section 15 contain the additional terms that the laws of the United States, the United Kingdom, Switzerland, Canada, Brazil and Türkiye require or that a Merchant in those countries needs, and no separate country-specific agreement is offered or signed.

Processor: CIQRA OÜ, registry code 16465907, Veskiposti tn 2, 10138 Tallinn, Harju maakond, Estonia · info@ciqra.com ("CIQRA") Controller: the Merchant that has accepted the Terms of Service ("Controller")

1. Definitions, roles and scope

1.1 In this DPA, "Merchant Personal Data" means personal data that CIQRA processes on the Controller's behalf in providing the Services, including personal data of the Controller's Shoppers, staff and users processed through the Controller's Storefront and account. Other capitalised terms have the meaning given in the GDPR or in the Terms of Service.

1.2 For Merchant Personal Data, the Merchant is the controller and CIQRA is the processor. CIQRA processes Merchant Personal Data only to provide the Services.

1.3 CIQRA is an independent controller for the personal data it processes for its own purposes: Merchant account, user and billing data, visitors to its own websites, its own support, security and fraud signals about Merchant accounts, and its own marketing. That processing is governed by the Privacy Policy, not by this DPA. Security monitoring, fraud prevention and analytics that involve Merchant Personal Data of Shoppers are part of the Services and are carried out on the Controller's instruction (Section 2.1); CIQRA does not use Merchant Personal Data of Shoppers for its own purposes. The Controller instructs CIQRA, by accepting this DPA, to derive from Merchant Personal Data, as part of the Services, anonymised statistics from which no individual can be identified; CIQRA may use those statistics to operate and improve the Services. For personal information subject to a US State Privacy Law, Section 14.3 applies instead; for personal information subject to a Canadian Privacy Law, Section 15.3.3 applies instead.

1.4 Stripe processes payment data under its own agreements, largely as an independent controller. Card details entered through CIQRA Pay checkout are captured directly by Stripe and are not processed by CIQRA.

1.5 This DPA prevails over any conflicting provision on the processing of personal data in the Terms of Service or the Merchant Agreement.

1.6 The Controller's responsibilities. As controller, the Controller is responsible for the lawfulness of the processing it instructs, including: having a legal basis for each purpose; giving data subjects the information required by Articles 13 and 14 GDPR (and, where applicable, KVKK Article 10) in its own privacy notice; obtaining and recording any consent it relies on, including for cookies, tracking and marketing; carrying out any data protection impact assessment its processing requires; answering data subjects' requests with the tools CIQRA provides; and ensuring that its instructions comply with the law. Where the Controller connects a third-party service or app and instructs CIQRA to make Merchant Personal Data available to it, that disclosure is the Controller's own, the third party is not a sub-processor of CIQRA, and the Controller is responsible for its contract with that third party. The Controller keeps its own copies of the Merchant Personal Data it needs (Terms of Service, Section 5.6). CIQRA informs the Controller if, in its opinion, an instruction infringes data-protection law, but is not obliged to review the lawfulness of the Controller's processing.

1.7 Applicable data-protection law. This DPA applies the terms of the GDPR to Merchant Personal Data wherever the Controller is established. Where Merchant Personal Data is also subject to the data-protection law of the United Kingdom, Switzerland, a US state, Canada or a Canadian province, Brazil or Türkiye, Sections 14 and 15 state how this DPA gives effect to that law; CIQRA acts as the Controller's processor under each of them, and the Controller is responsible for the obligations that the law of its own country places on it as controller. Where two of those laws conflict for particular Merchant Personal Data, the parties apply the law that applies to that data.

2. Instructions

2.1 CIQRA processes Merchant Personal Data only on the Controller's documented instructions, including with regard to transfers to third countries, unless EU or Member State law requires otherwise; in that case CIQRA informs the Controller of the legal requirement before processing, unless the law prohibits this. The Controller's documented instructions consist of this DPA, the Terms of Service and the Controller's configuration and use of the Services.

2.2 CIQRA informs the Controller without delay if, in its opinion, an instruction infringes the GDPR or other data-protection law.

3. Confidentiality

CIQRA ensures that persons authorised to process Merchant Personal Data are bound by confidentiality obligations and have access only to the extent necessary for their tasks.

4. Security

CIQRA implements the technical and organisational measures described in Annex II to ensure a level of security appropriate to the risk, as required by Article 32 GDPR. CIQRA may update these measures, provided that the overall level of security is not reduced.

5. Sub-processors

5.1 General authorisation. The Controller gives CIQRA general authorisation to engage the sub-processors listed in the Subprocessor List, which forms Annex III to this DPA. CIQRA imposes on each sub-processor, by contract, data-protection obligations that provide at least the same level of protection as this DPA, including Standard Contractual Clauses where a transfer outside the EEA takes place, and remains liable to the Controller for the performance of each sub-processor's obligations.

5.2 Notice and objection. CIQRA gives at least 30 days' prior notice of any intended addition or replacement of a sub-processor by updating the Subprocessor List and notifying Merchants by email or in the dashboard. The Controller may object on reasonable data-protection grounds within 30 days of the notice. The parties will work in good faith to resolve the objection. If it cannot be resolved, the Controller may, as its sole remedy, terminate the affected Services and receive a pro-rata refund of any prepaid fees for the terminated part. If the Controller does not object within the notice period, the change is deemed accepted.

5.3 Urgent replacements. Where CIQRA must engage a sub-processor urgently to protect the security or availability of the Services (for example, during an incident or a provider failure), it may do so before the notice period ends only with a sub-processor established in the EEA or in a country covered by an adequacy decision, only for the duration of the incident and only for the Merchant Personal Data the incident requires. CIQRA informs the Controller before the replacement takes effect where it can, and otherwise within 72 hours with the information it gives under Section 5.2 and stops using that sub-processor for the Controller's data if the Controller objects on reasonable data-protection grounds within 30 days of that notice, without prejudice to the remedy in Section 5.2.

6. Data-subject requests

Taking into account the nature of the processing, CIQRA assists the Controller, by appropriate technical and organisational measures, in responding to requests from data subjects exercising their rights under Chapter III of the GDPR. CIQRA forwards to the Controller, without undue delay, any request it receives directly that relates to Merchant Personal Data, and does not respond to it except on the Controller's instructions or as required by law.

On the Controller's instruction, CIQRA carries out an erasure request: the Shopper's account and personal data (such as support tickets, live chat, reviews and wishlists) are erased or anonymised, and in financial records the person is removed or anonymised while the transaction is kept for the legal retention period in Section 9.3 (Article 17(3)(b) GDPR). Consent and opt-out records needed to keep honouring a withdrawal of consent are retained (Article 17(3)(e) GDPR).

7. Assistance

Taking into account the nature of the processing and the information available to it, CIQRA assists the Controller in meeting its obligations under Articles 32 to 36 GDPR, including security of processing, notification of personal-data breaches, data protection impact assessments and prior consultation with a supervisory authority. Assistance is provided first through the self-service tools and documentation of the Services. Where the Controller asks for assistance that goes beyond them and beyond what CIQRA must provide under this DPA without charge, CIQRA may charge its reasonable costs after telling the Controller the expected amount; it does not charge for assistance needed because of its own breach of this DPA or for notifying a personal-data breach.

8. Personal-data breaches

CIQRA notifies the Controller without undue delay after becoming aware of a personal-data breach affecting Merchant Personal Data: where possible within 24 hours, and at the latest within 72 hours. The notification includes the information reasonably available to CIQRA that the Controller needs to meet its own obligations under Articles 33 and 34 GDPR, and CIQRA supplements it as further information becomes available. The procedure is described in the Data Retention and Breach Notification Policy.

9. Retention, deletion and return

9.1 Retention during the Services. CIQRA keeps Merchant Personal Data for the following default periods, which apply unless the Controller gives a different lawful instruction:

  • orders, invoices, payment and accounting records: while the store is active; they are not deleted early (for the period after closure, see Section 9.3);
  • Shopper accounts and Shopper personal data, including support tickets, live chat with Shoppers, reviews and wishlists: while the store is active; ended for an individual Shopper by an erasure request under Section 6;
  • contact and enquiry form submissions: while the store is active, unless the Controller chooses a shorter period of 6, 12, 24 or 36 months in its store settings (Settings → Customer privacy → Data retention). That choice is the Controller's documented instruction under Section 2.1;
  • identity and financial numbers in form submissions: kept as submitted by default. The Controller may switch on an option, off by default, under which CIQRA replaces with "[masked]", 7, 30, 90, 180 or 365 days after the submission (as the Controller chooses), the value of every form field for a national ID or Turkish ID number, driving licence, passport, tax number, IBAN or social security number, and any valid Turkish ID number in any field. The rest of the enquiry is not changed;
  • logs migrated from the Controller's previous system: while the store is active, unless the Controller chooses 24 or 36 months in its store settings. Because these logs contain IP addresses that a Controller may have to keep under the law of its own country (for example Türkiye's Law No. 5651 for hosting providers in Türkiye), CIQRA keeps them for at least 2 years unless the Controller instructs a shorter period in writing;
  • Storefront analytics events with pseudonymous identifiers: 400 days;
  • abandoned carts (carts and checkouts that did not become an order) and cart-recovery e-mails: 1 year;
  • marketing consent records (newsletter consent records and the cookie-consent log): while the consent is valid. A newsletter unsubscribe record is kept by default, because it proves that the withdrawal is honoured. The Controller may switch on an option, off by default, to delete withdrawn consents 3 years after withdrawal, and a second option, also off by default, to count those 3 years from the import date where an imported unsubscribe has no withdrawal date. As an alternative to deletion the Controller may switch on a third option, also off by default and not combinable with deletion, under which 3 years after withdrawal CIQRA replaces the address in the unsubscribe record with a one-way hash and drops the shopper's IP hash, so that the withdrawal keeps being honoured without the address being kept. Because a cookie consent is valid for at most 365 days, cookie-consent records are kept for 365 days plus 3 years. Opt-out records that give effect to a withdrawal are kept for as long as needed to keep honouring it;
  • security and audit logs: 2 years; application and delivery logs: 12 months; backups: see Section 9.4.

9.2 End of the Services. After the Services end, the Controller may export Merchant Personal Data during the transition period and the retrieval period in Section 13.3 of the Terms of Service (together 60 days). CIQRA then keeps the data of the closed store with restricted access, processes it only for storage and for restoring the store at the Controller's request, and deletes it, including existing copies, 2 years after the store is closed, except the records described in Section 9.3. At the Controller's choice, CIQRA returns the data through the export tools and, on the Controller's written instruction, deletes it before the end of that 2-year period without undue delay.

9.3 Records the law requires to be kept. Orders, invoices, payment, refund and ledger records are kept for 10 years after the store is closed. That is the longest commercial record-keeping period that CIQRA has identified among the laws of its Merchants' markets (for example 10 years under Türkiye's Commercial Code art. 82; the Estonian Accounting Act requires 7 years), so that a Controller can meet its own record-keeping duty from the platform; the Controller may instruct a shorter period in writing where the law that applies to it allows. CIQRA protects these records, restricts access to them and processes them only for the purpose for which they must be kept. An erasure request removes or anonymises the person in these records and keeps the transaction.

9.4 Backups. CIQRA keeps database backups with point-in-time recovery for up to 35 days on a rolling basis, and recoverable copies of deleted or overwritten files for 30 days. CIQRA may also keep protected long-term copies of the database and of stored files: copies taken weekly or more often for up to 8 weeks, and one copy a month for up to 6 months. Each copy is deleted when its period ends. Individual records are not removed from backup copies, and the long-term copies are held in a separate store designed to prevent them being altered or deleted before their period ends. Deleted data therefore leaves the backups when the copies holding it expire: at the latest 6 months after its deletion. Until then, data held only in a backup is not used for any purpose other than restoring the Services or lost data, is not used to make any decision about anyone, is not disclosed to anyone other than the sub-processor that hosts the backups, is accessible only to a small number of authorised CIQRA administrators under role-based access control and to the automated service identities that operate the platform and the backup service (administrative actions on the backups are logged), and is encrypted and stored in Germany as set out in Annex II. If a backup is restored, CIQRA, before the restored data is used, deletes again the data whose deletion or erasure was recorded after the backup was taken; for this purpose CIQRA keeps backup copies for longer than 35 days only while it keeps a record of deletions and erasures outside the backed-up database. The backup periods are the same for every Merchant, because the backups cover the whole platform; a Controller therefore cannot instruct a shorter period for its own data alone. A Controller that objects to these periods may terminate the Services without charge before they take effect for it (Terms of Service, Section 14.3). The Controller instructs CIQRA that the deletion of backup copies under Section 9.2 is carried out by their expiry as set out in this Section 9.4. Backup archives of a store that the Controller creates or schedules itself in its dashboard are kept for the period the Controller chooses there, as its instruction. The backups described in this Section serve CIQRA's recovery of the Services as a whole; they are not a backup or archiving service for the Controller, and the Controller remains responsible for keeping its own copies (Terms of Service, Section 5.6).

9.5 Confirmation and records of deletion. On written request, CIQRA confirms in writing that the deletion has been carried out. Each deletion or masking carried out under a retention period is recorded (which table and category, what was done, how many records and the cut-off date; the record contains no personal data). These records are kept for at least 3 years and are not deleted automatically.

9.6 Enterprise plans. For a Controller on an Enterprise plan, retention of the Controller's own data is governed by its contract: while the contract is in force, the data is kept without a time limit and is not deleted by automated retention schedules, and a closed Enterprise store is not purged automatically. CIQRA sends the Controller a reminder of this retention, and of the data it holds, once a year. Security and audit logs, delivery logs and backups keep the periods above on every plan. An option that an Enterprise Controller switches on itself, such as masking, applies as its instruction.

9.7 Introduction of new periods. Some deletion periods in this Section are new (abandoned carts, the cookie-consent log, periods and options chosen by the Controller, including masking and deletion of withdrawn consents, and deletion 2 years after closure). CIQRA is switching them on in stages. Until a period is switched on, the data concerned is kept for longer; it is not deleted earlier than stated.

10. Audits

CIQRA makes available to the Controller the information necessary to demonstrate compliance with Article 28 GDPR and allows for and contributes to audits, as follows:

(a) CIQRA first responds to audit requests by providing documentation, summaries of its security measures and any third-party certifications or audit reports it holds;

(b) if that information is not sufficient to demonstrate compliance, the Controller, or an independent auditor bound by confidentiality and reasonably acceptable to CIQRA, may carry out an audit or inspection no more than once in any 12-month period (or more often where required by law or following a personal-data breach), on at least 30 days' prior written notice, during business hours, without unreasonably disrupting CIQRA's operations and at the Controller's cost. Audits do not extend to other customers' data or to CIQRA's confidential information that is not relevant to the processing.

11. International transfers

11.1 Merchant Personal Data is hosted in the EU (Microsoft Azure, Germany), and AI features are processed in the EU Data Zone (Section 13). Where CIQRA or a sub-processor transfers Merchant Personal Data to a country outside the EEA that is not covered by an adequacy decision, the transfer is made under the EU Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("SCCs"), which are incorporated into this DPA by reference. Where the recipient is established in the United States and certified under the EU-U.S. Data Privacy Framework, the transfer may also rely on the adequacy decision in Commission Implementing Decision (EU) 2023/1795. Because CIQRA is established in the EEA, a transfer of Merchant Personal Data from the Controller to CIQRA is not a restricted transfer under the GDPR, and Module Two of the SCCs is not used between the Controller and CIQRA; transfers governed by other laws are dealt with in Section 15. The SCCs apply as follows: Module Three (processor to processor) between CIQRA and each sub-processor established in, or accessing Merchant Personal Data from, a country without an adequacy decision; and, where the Controller is established outside the EEA in a country without an adequacy decision, Module Four (processor to controller) for the transfer of Merchant Personal Data from CIQRA to the Controller. Where the recipient's own processing is itself subject to the GDPR under Article 3(2), the transfer is still a transfer under Chapter V of the GDPR, and, until the Commission adopts standard contractual clauses for that case, CIQRA applies Module Four of the SCCs between the parties as a contractual safeguard, read with the adaptations that the importer's own GDPR obligations require, and replaces it with the Commission's clauses when they are adopted. For Module Three the elections are: Clause 7 (docking clause) applies; under Clause 9(a) Option 2 (general written authorisation) applies, with a notice period of 30 days for changes to the sub-processor's own sub-processors, which the sub-processor gives to CIQRA and CIQRA passes on under Section 5.2; the optional language in Clause 11(a) is not used; under Clause 13(a) and Annex I.C the competent supervisory authority is the Estonian Data Protection Inspectorate; under Clause 17 Option 1 applies and the SCCs are governed by the law of Estonia; and under Clause 18 disputes are resolved by the courts of Estonia. For Module Four the elections are: Clause 7 applies; under Clause 17 the SCCs are governed by the law of Estonia; and under Clause 18 disputes are resolved by the courts of Estonia. Module Three is concluded between CIQRA and each sub-processor, with that sub-processor's own Annexes, and CIQRA gives the Controller a copy on request as Clause 9(c) provides. For Module Four, Annex I of this DPA, read with the roles stated in Annex I.A for that Module, and Annex II are the Annexes to the SCCs; the data exporter is CIQRA and the data importer is the Controller, identified by the details in its account. By publishing this DPA CIQRA signs those SCCs as data exporter, and by accepting the Terms of Service, which include this DPA, the SCCs and these Annexes, the Controller signs them as data importer. For transfers subject to the law of the United Kingdom, Section 15.2 applies; for transfers subject to Swiss law, Section 15.1.4 applies.

11.2 CIQRA has assessed the laws and practices of each destination country and the supplementary measures needed for restricted transfers (a transfer impact assessment). A summary is published in Section 9 of the Subprocessor List. CIQRA keeps the assessment under review and provides the full assessment to the Controller on request. CIQRA does not make Merchant Personal Data readable by a sub-processor established in, or accessing it from, a country that is not covered by an adequacy decision, unless the Subprocessor List states the supplementary measures that apply and CIQRA's transfer impact assessment concludes that they are effective for the data concerned.

11.3 Requests from public authorities. If CIQRA receives a legally binding request from a public authority for disclosure of Merchant Personal Data, it notifies the Controller before disclosing, unless the law prohibits this, reviews the legality of the request and challenges it where it has reasonable grounds to consider it unlawful, and discloses only the minimum that the request legally requires. CIQRA keeps a record of such requests and makes it available to the Controller on request to the extent the law allows.

12. Liability

Each party's liability under this DPA is subject to the limitations of liability in Section 11 of the Terms of Service, to the extent permitted by law. This does not limit the rights of data subjects under the GDPR or the SCCs. Where both parties are liable to a data subject for the same damage, each party bears, between the parties, the part of the damage that corresponds to its share of responsibility (Article 82(5) GDPR). CIQRA is responsible as processor only where it has not complied with obligations of the GDPR directed specifically to processors or has acted outside or contrary to the Controller's lawful instructions (Article 82(2) GDPR); damage caused by the Controller's own instructions, by processing the Controller carries out or by third-party services the Controller connects is the Controller's responsibility, and Section 12.1 of the Terms of Service applies to it.

13. AI features

13.1 Where the Controller uses AI features, CIQRA processes Merchant Personal Data through the AI sub-processor listed in the Subprocessor List (Microsoft Azure AI Foundry, on EU Data Zone deployments in Germany West Central and Sweden Central) only as needed to provide the requested feature, sends it only the input the feature requires, and uses it under business terms under which customer inputs and outputs are not used to train models; under those terms Microsoft may retain inputs and outputs for a limited period for abuse monitoring, which is processing by Microsoft as CIQRA's sub-processor under the measures in the Subprocessor List. By default, e-mail addresses, telephone numbers, payment card numbers and IBANs in the Controller's prompts are replaced with placeholders before they are sent, and the AI assistant's tools pass customer names and contact details to the model only in masked form, as described in Section 2.1 of the AI Features Terms.

13.2 The Controller must not use AI features to process special categories of personal data, or more personal data than the feature requires, without its own legal basis and appropriate safeguards. CIQRA supports the transparency obligations of Article 50 of the EU Artificial Intelligence Act as described in the AI Features Terms.

14. United States privacy laws

14.1 Scope. This Section applies where Merchant Personal Data includes personal information of residents of a US state whose consumer-privacy law applies to the Controller, such as the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), or the laws of Virginia, Colorado, Connecticut, Texas, Oregon and other states with comparable laws (together, "US State Privacy Laws"). Terms such as "business", "service provider", "controller", "processor", "sell" and "share" have the meaning given in the applicable US State Privacy Law.

14.2 CCPA service provider. For personal information subject to the CCPA, CIQRA acts as the Controller's service provider. CIQRA: (a) processes that personal information only for the following limited and specified business purposes, for which the Controller discloses it to CIQRA, and for no other purpose: hosting, storing and displaying the Controller's Storefront and account; processing orders, payments through CIQRA Pay, shipping and returns; search and product recommendations within the Controller's Storefront; sending transactional and, on the Controller's instruction, marketing communications; analytics for the Controller as configured by the Controller; AI-assisted features where the Controller uses them; and operating, securing, supporting and debugging the Services (Annex I); (b) does not sell or share it; (c) does not retain, use or disclose it for any purpose, including any commercial purpose, other than those business purposes and the internal uses in Section 14.3, or outside the direct business relationship between CIQRA and the Controller; (d) does not combine it with personal information that CIQRA receives from or on behalf of another person or collects from its own interactions with consumers, except as the CCPA regulations permit; (e) complies with the obligations of the CCPA that apply to service providers and provides the same level of privacy protection as the CCPA requires of businesses, including reasonable security (Section 4 and Annex II); (f) notifies the Controller within 5 business days if it determines that it can no longer meet its obligations under the CCPA; (g) engages a sub-processor to process that personal information only under a written contract that imposes the same obligations as this Section 14 and only after notice to the Controller under Section 5.2; and (h) enables the Controller to comply with consumer requests through the tools in Section 6, acts on a request the Controller forwards to it, including a request to delete, correct or opt out, within the time the Controller specifies or, if none is specified, within 10 business days, and tells its sub-processors to do the same. The Controller may take reasonable and appropriate steps, through the audit and information process in Section 10, to ensure that CIQRA uses the personal information consistently with the Controller's CCPA obligations, and, on notice, to stop and remediate unauthorised use. CIQRA certifies that it understands and will comply with the restrictions in this Section 14.

14.3 CIQRA's internal uses. For personal information subject to a US State Privacy Law, CIQRA does not act as an independent business or controller, and Section 1.3 applies to it only as follows. CIQRA may use that personal information, as the CCPA regulations permit service providers to (Cal. Code Regs. tit. 11, §7050(a)): (a) to detect security incidents and protect against malicious, deceptive, fraudulent or illegal activity on the Services; (b) to build or improve the quality of the Services, provided that CIQRA does not use it to build or modify a profile of a consumer for use in providing services to another person, does not correct or augment data acquired from another source, and does not use the content of Shoppers' communications (such as chat or support messages) for this purpose; (c) to retain and employ sub-processors under Section 14.2(g); and (d) to comply with the law, with a lawful request of an authority, or to establish, exercise or defend legal claims. Aggregated analytics that CIQRA uses for its own purposes are produced only from information that is deidentified (Section 14.8).

14.4 Advertising destinations. Where the Controller enables an advertising integration or server-side event forwarding to an advertising platform (Privacy Policy, Section 6), the disclosure to that platform is the Controller's own, and the platform receives the data under its own terms with the Controller. To the extent a US State Privacy Law treats CIQRA, for that forwarding, as a third party or as a person providing cross-context behavioural advertising rather than as a service provider, CIQRA: (a) uses the personal information only for the limited and specified purpose of delivering the events that the Controller has configured to the destinations that the Controller has chosen; (b) complies with the applicable US State Privacy Law and provides the same level of privacy protection as the CCPA requires of businesses; (c) gives the Controller the rights in the second-to-last sentence of Section 14.2 and notifies it within 5 business days if it can no longer meet its obligations; and (d) does not forward the events of a consumer who has opted out of sale, sharing or targeted advertising, whether through a Global Privacy Control signal, the Storefront's cookie settings or a request the Controller forwards to CIQRA. The Controller is responsible for disclosing the sale, sharing or targeted advertising in its own notices, for offering the opt-out and any consent the law requires, and for its contract with each advertising platform.

14.5 Other US State Privacy Laws. For personal data subject to a US State Privacy Law other than the CCPA, CIQRA acts as the Controller's processor. The following provisions of this DPA give effect to that law's processor-contract requirements: processing only on documented instructions, with the nature, purpose, type of data and duration of the processing described in Section 2 and Annex I; a duty of confidentiality for each person who processes the data (Section 3); security measures (Section 4 and Annex II); engagement of sub-processors under a written contract, with notice and an opportunity to object (Section 5); assistance with consumer requests, security, breach notification and data protection assessments (Sections 6 to 8); deletion or return of the data at the Controller's choice at the end of the Services, unless the law requires retention (Section 9); and making available the information needed to demonstrate compliance and allowing assessments (Section 10). Instead of an audit under Section 10(b), CIQRA may, at its option and expense, arrange for a qualified and independent assessor to assess its policies and technical and organisational measures at least once a year against an appropriate and accepted control standard, and gives the Controller a report of the assessment on request.

14.6 Consumer health data. Where Merchant Personal Data includes consumer health data within the meaning of the Washington My Health My Data Act (RCW 19.373) or a comparable law of another state, CIQRA processes it only under this DPA as a binding contract and on the Controller's documented instructions, and assists the Controller, by the tools in Section 6, in responding to consumers' requests under those laws. The Controller is responsible for obtaining the consents those laws require, including any separate consent to collect or share consumer health data and any valid authorisation for its sale, and for publishing on its Storefront the consumer health data privacy policy those laws require. CIQRA does not offer geofencing around health-care facilities.

14.7 Minors. The Controller must not enable advertising destinations, or otherwise sell or share personal information or process it for targeted advertising, for consumers it knows to be under 16, or under a higher age where a US State Privacy Law sets one, unless it has obtained the opt-in consent that law requires. Where a law prohibits targeted advertising to known minors altogether, the Controller must not do so.

14.8 Deidentified data. Where CIQRA holds deidentified information derived from Merchant Personal Data, CIQRA takes reasonable measures to ensure that it cannot be associated with a consumer or household, publicly commits to keep it in deidentified form and not to attempt to reidentify it except as the law permits, and contractually requires any recipient to do the same.

14.9 The Controller's responsibilities. The Controller is responsible for its own obligations under US State Privacy Laws, including its privacy notice and notice at collection, honouring opt-out requests and opt-out preference signals with the tools the Services provide, any consent it relies on, and any agreement it must have with third parties it connects to the Services (Section 1.6). CIQRA honours the Global Privacy Control signal on every Storefront as described in the Cookie Policy.

15. Regional supplements

This Section contains the additional terms that apply where Merchant Personal Data is subject to the laws named below. Each supplement adds to, and where it says so prevails over, the other Sections of this DPA for the data it covers. It does not create a separate agreement, and CIQRA does not sign country-specific data-processing or transfer agreements in addition to this DPA.

15.1 European Union, European Economic Area and Switzerland

15.1.1 Scope and law. This supplement applies to Merchant Personal Data subject to the GDPR, to the GDPR as incorporated in the EEA Agreement, or to the Swiss Federal Act on Data Protection ("FADP"). CIQRA is established in the European Union and processes Merchant Personal Data in the context of that establishment, so the GDPR applies to CIQRA's processing of Merchant Personal Data wherever the Controller is established, and CIQRA complies with the obligations of a processor under it. A Controller that is established outside the EEA and subject to Article 3(2) GDPR is responsible for appointing its representative under Article 27 GDPR.

15.1.2 Standard Contractual Clauses. Section 11.1 states how the SCCs apply and the elections made under them. In a conflict, the SCCs prevail over this DPA, and this DPA prevails over the Terms of Service and any Order Form on the processing of personal data (Section 1.5).

15.1.3 Supervisory authorities and assistance. CIQRA cooperates with the competent supervisory authority on request (Article 31 GDPR); nothing in Section 10 limits the powers of a supervisory authority. CIQRA makes its transfer impact assessment available to the Controller on request (Section 11.2) and informs the Controller without undue delay if it has reason to believe that it or a sub-processor can no longer comply with the SCCs or with the assessment's conclusions.

15.1.4 Switzerland. For Merchant Personal Data subject to the FADP, this DPA and the SCCs apply with these amendments: references to the GDPR and to its articles are references to the FADP and its corresponding provisions; the competent supervisory authority under Clause 13 of the SCCs is the Federal Data Protection and Information Commissioner (FDPIC) where the transfer is subject to the FADP; references to a "Member State" do not prevent data subjects in Switzerland from bringing a claim in their place of habitual residence in Switzerland (Clause 18(c)). A transfer from Switzerland to the EEA is a transfer to countries that Switzerland recognises as providing adequate protection.

15.1.5 Liability to data subjects. Nothing in this DPA or the Terms of Service limits the rights of data subjects under the GDPR, the FADP or the SCCs, or CIQRA's liability to data subjects under Clause 12 of the SCCs and Article 82 GDPR. Between the parties, Section 12 applies to every claim under this DPA, including a claim between the parties under the SCCs to the extent the SCCs allow liability between the parties to be limited.

15.2 United Kingdom

15.2.1 UK Data Protection Law. "UK Data Protection Law" means the UK GDPR (as defined in section 3(10) of the Data Protection Act 2018), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003, each as amended. To the extent Merchant Personal Data is subject to UK Data Protection Law, this DPA is the contract required by Article 28(3) of the UK GDPR, and in this DPA: (a) references to the GDPR and to its articles include the corresponding provisions of the UK GDPR; (b) "Member State law" includes the law of the United Kingdom or of a part of it; (c) "supervisory authority" includes the UK Information Commissioner (or any successor body); and (d) "adequacy decision" includes regulations made by the United Kingdom that recognise a country as providing adequate protection.

15.2.2 Transfers to CIQRA. A transfer of Merchant Personal Data from the Controller in the United Kingdom to CIQRA in Estonia is a transfer to a country that the United Kingdom recognises as adequate, and no further safeguard is required for it unless that recognition ends; if it ends, the parties adopt Module Two of the SCCs for that transfer only, with the Controller as exporter and CIQRA as importer and the elections in Section 11.1 for Module Three applied to it with the necessary changes, and Section 15.2.3 applies to it.

15.2.3 UK Addendum. Where a transfer of Merchant Personal Data subject to UK Data Protection Law is a restricted transfer under that law, including an onward transfer by CIQRA or a sub-processor to a country outside the United Kingdom that is not covered by United Kingdom adequacy regulations, the parties enter into the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, version B1.0, in force 21 March 2022 (the "UK Addendum"), which is incorporated into this DPA by reference and completed as follows. Table 1 (Parties): start date, the date on which the Controller accepts this DPA; the exporter is the Controller (or, for an onward transfer by CIQRA, CIQRA) and the importer is CIQRA (or, for an onward transfer, the sub-processor named in Annex III); contact details as in the Terms of Service and Annex I; acceptance of the Terms of Service is signature. Table 2 (Selected SCCs, Modules and Selected Clauses): the SCCs incorporated by Section 11.1, with the modules, options and clauses elected there. Table 3 (Appendix Information): Annexes I, II and III of this DPA. Table 4 (Ending this Addendum when the Approved Addendum changes): neither party. The Mandatory Clauses of the UK Addendum apply and prevail over any conflicting term of this DPA or of the SCCs for transfers subject to UK Data Protection Law. The parties may instead rely on the UK International Data Transfer Agreement where one of them so notifies in writing and the other agrees, or where the UK Addendum is no longer available.

15.2.4 UK-US data bridge. CIQRA relies on the UK Extension to the EU-U.S. Data Privacy Framework for a transfer to a sub-processor in the United States only while that sub-processor is certified for the UK Extension; otherwise Section 15.2.3 applies.

15.2.5 Governing law of the UK Addendum. The UK Addendum is governed by the law of England and Wales, and disputes arising from it are resolved by the courts of England and Wales, as its Mandatory Clauses require; Section 15 of the Terms of Service does not apply to those disputes.

15.2.6 Breach and complaints. For UK Data Protection Law, the notification under Section 8 is the notification the Controller needs in order to meet Articles 33 and 34 of the UK GDPR, and CIQRA helps the Controller deal with a complaint under the UK data-protection complaints procedure.

15.3 Canada, including Québec

15.3.1 Scope and terms. This supplement applies where Merchant Personal Data includes personal information subject to the Personal Information Protection and Electronic Documents Act (Canada) ("PIPEDA"), the Act respecting the protection of personal information in the private sector (Québec) ("Québec Private Sector Act"), the Personal Information Protection Act of Alberta or of British Columbia, or another Canadian privacy law that applies to the Controller (together "Canadian Privacy Laws"). "Personal information", "privacy officer", "confidentiality incident" and similar terms have the meaning in the applicable Canadian Privacy Law. For such personal information the Controller is the organisation or enterprise responsible for it, and CIQRA is its service provider and the person to whom a mandate or a contract for services is entrusted. This supplement prevails over the other Sections of this DPA for that personal information to the extent they conflict.

15.3.2 Written mandate. This DPA is the written contract for the purposes of section 18.3 of the Québec Private Sector Act and the contractual means required by Principle 4.1.3 of Schedule 1 to PIPEDA. CIQRA provides a level of protection for the personal information that is comparable to the protection required by the Canadian Privacy Laws that apply to the Controller.

15.3.3 Purpose limitation and no onward use. CIQRA (a) processes the personal information only to carry out the mandate and perform the Services for the Controller, as described in Section 2 and Annex I; (b) does not use or communicate it for any other purpose, including its own purposes, except to detect security incidents and protect against fraud and illegal activity on the Services, and to comply with the law or a lawful request of an authority; (c) does not anonymise, aggregate or de-identify it for CIQRA's own purposes except in a form from which no individual can be identified; (d) communicates it to a sub-processor only under Section 5 and only if the sub-processor is bound in writing by obligations at least as protective as this supplement; and (e) does not sell it.

15.3.4 Confidentiality and security. CIQRA protects the personal information with the measures in Annex II, which the Controller accepts as the measures that CIQRA must take to protect its confidentiality for the purposes of section 18.3 of the Québec Private Sector Act and the safeguards principle of PIPEDA, and keeps it confidential as set out in Section 3.

15.3.5 Notice of incidents and of attempted violations. CIQRA notifies the Controller's privacy officer or, if none has been named in the account, the account owner, without undue delay, where possible within 24 hours and at the latest within 72 hours, after becoming aware of (a) any confidentiality incident or breach of security safeguards affecting the personal information, and (b) any violation or attempted violation by any person of an obligation of confidentiality concerning the personal information. The notice states, as far as then known: the personal information concerned; the circumstances and, if known, the cause; the date or period; the number of individuals concerned and, where known, how many are in Québec and in other Canadian provinces; the steps CIQRA has taken to contain the incident and to reduce the risk of harm; and a contact point. CIQRA supplements the notice as it learns more and gives the Controller what it reasonably needs to assess whether there is a risk of serious injury (Québec) or a real risk of significant harm (PIPEDA and Alberta), to notify the authorities and the individuals concerned, and to keep its incident register and breach records. CIQRA does not itself notify an authority or individuals about the Controller's personal information unless the law requires CIQRA to do so or the Controller asks.

15.3.6 Verification. CIQRA first answers a request to verify its compliance with the confidentiality requirements of this supplement with documents and written answers. The Controller's privacy officer may in addition carry out a verification of those requirements, remotely where this is sufficient, on 10 business days' notice, or promptly after a notice under Section 15.3.5, in a way that does not disrupt CIQRA's operations or give access to other customers' data. Section 10 applies to any other audit.

15.3.7 Requests and assistance. CIQRA assists the Controller, with the tools in the Services and within the periods the Controller needs to meet a 30-day statutory response period, in: access, correction and withdrawal-of-consent requests; the transfer of personal information in a structured, commonly used technological format; the cessation of dissemination or de-indexation of personal information published through the Controller's Storefront (such as a Shopper review); the information and review owed to an individual about a decision based exclusively on automated processing; and the Controller's privacy impact assessments, including the one required before personal information is communicated outside Québec. Section 6 applies to requests that CIQRA receives directly.

15.3.8 End of the mandate: return and destruction. After the Services end, the Controller may export the personal information during the 60-day period in Section 9.2. The Controller instructs CIQRA, by accepting this DPA, to keep the personal information of the closed store afterwards in restricted storage, for the sole purpose of restoring the store at the Controller's request, for the period in Section 9.2, and to destroy it at the end of that period; that instruction is the Controller's archive instruction for the purposes of the Canadian Privacy Laws, and the Controller may replace it at any time by a written instruction to destroy earlier, which CIQRA carries out without undue delay. Records that the Controller must keep by law are kept under Section 9.3 as the Controller's record-keeping instruction, and an Order Form for an Enterprise plan that provides for continued retention is the Controller's written instruction for the personal information it covers and states the period or, where it provides for retention without a time limit, provides that the personal information is kept until the Controller instructs its destruction. Copies in backups are put beyond use, are used only to restore the Services as a whole and are destroyed when they expire under Section 9.4. On written request, CIQRA confirms in writing to the Controller's privacy officer that the destruction has been carried out, stating the date and the categories destroyed (Section 9.5).

15.3.9 Communication outside Québec and outside Canada. The Controller acknowledges that the personal information is hosted by CIQRA in Germany (Microsoft Azure), is accessed by CIQRA's staff and service providers as described in the Subprocessor List, and may be communicated to the sub-processors listed in the Subprocessor List in the countries stated there. CIQRA gives the Controller, on request and without charge, the information it holds that the Controller needs for the privacy impact assessment that section 17 of the Québec Private Sector Act requires before personal information is communicated outside Québec, including the description of the transfers, the measures in Annex II, the transfer impact assessment summary in the Subprocessor List and the sub-processor list. CIQRA tells the Controller without undue delay if it learns that a change in the laws of a destination country is likely to prevent it from complying with this supplement. Section 11.3 applies to requests from public authorities.

15.3.10 The Controller's responsibilities. The Controller is responsible for its own obligations under the Canadian Privacy Laws, including: designating a person in charge of the protection of personal information and publishing that person's title and contact details; its privacy notices, consents and policies, in French where the law requires; its privacy impact assessments; its incident register and its notices to the authorities and individuals; the lawfulness of every instruction it gives; and its compliance with Canada's Anti-Spam Legislation for messages it sends through the Services, for each of which it confirms that it holds valid consent or that an exception applies.

15.4 Brazil

15.4.1 Scope and roles. This supplement applies to Merchant Personal Data subject to the Brazilian General Data Protection Law (Lei 13.709/2018, "LGPD"), including Merchant Personal Data collected in Brazil or relating to individuals in Brazil. For that data the Controller is the controlador and CIQRA is the operador; CIQRA is the controlador of the personal data it processes for its own purposes (Section 1.3). Terms such as "controlador", "operador", "encarregado", "titular" and "ANPD" have the meaning given in the LGPD. In a conflict about such data, this supplement prevails over the other Sections of this DPA.

15.4.2 Operator duties. CIQRA: (a) processes the data only according to the Controller's lawful instructions (Article 39 LGPD), as set out in Section 2; (b) keeps a record of its processing operations as operator (Article 37 LGPD) and makes it available to the Controller on request to the extent needed to respond to the Brazilian National Data Protection Authority (ANPD); (c) applies the security measures in Annex II, in line with Article 46 LGPD; (d) assists the Controller with requests from titulares under Articles 18 and 19 LGPD, including by forwarding any request it receives under Section 6, and with information the ANPD requests, with the time limits of Article 19 in mind; (e) ensures that persons authorised to process the data are bound by confidentiality (Section 3); (f) engages sub-processors only as set out in Section 5 and under a written contract with at least the same data-protection obligations; and (g) at the end of the Services returns or deletes the data as set out in Section 9, subject to retention that the law requires (Article 16 LGPD).

15.4.3 International transfer to CIQRA (Article 33 LGPD). The Controller transfers Merchant Personal Data to CIQRA in Estonia and, for hosting, in Germany. The parties rely on the following, in this order: (a) where the ANPD has recognised the European Economic Area or the European Union as providing an adequate level of protection under Article 34 LGPD and that decision is in force, on that decision; (b) otherwise, on the standard contractual clauses approved by the ANPD (Resolution CD/ANPD No. 19/2024, Annex II, the "ANPD Clauses"), which are incorporated into this DPA by reference in the version published by the ANPD, without alteration of their mandatory text, with the Controller as exporter and CIQRA as importer acting as operator; the information the ANPD Clauses require is given by this DPA and its Annexes, the contact point of the Controller is the contact in its account, the contact point of CIQRA is info@ciqra.com, and the competent authority is the ANPD; where option (b) applies, the ANPD Clauses prevail over this DPA and the Terms of Service on their subject matter, including as to governing law and jurisdiction, for disputes about the transfer; and (c) where neither applies, on another mechanism in Article 33 LGPD that the Controller documents. Accepting the Terms of Service constitutes execution of the ANPD Clauses by both parties where they apply. The EU SCCs in Section 11 continue to apply to transfers by CIQRA that are subject to the GDPR and do not replace this supplement for transfers subject to the LGPD. CIQRA sends the Controller, on request, the full text of the clauses and the information it needs to give to titulares about the transfer.

15.4.4 Onward transfers. CIQRA transfers Merchant Personal Data subject to the LGPD to sub-processors outside the EEA only to a country or recipient covered by an adequacy decision of the ANPD, or under the ANPD Clauses, the EU SCCs where the ANPD recognises them as equivalent, or another mechanism in Article 33 LGPD; where none of these is available for a sub-processor, the Controller may object under Section 5.2. Merchant Personal Data of Shoppers is not hosted in Türkiye; where it is contained in support correspondence, it is processed by the provider of CIQRA's business email under the measures stated in the Subprocessor List.

15.4.5 The Controller's responsibilities. Section 1.6 applies. In addition the Controller is responsible, as controlador, for the information it owes to titulares under Article 9 LGPD, for its legal bases under Articles 7 and 11 LGPD, for the appointment and publication of its encarregado where required, for the report on impact on personal data protection where the ANPD requires it, and for documenting the transfer mechanism required by Article 33 LGPD for the transfer to CIQRA.

15.4.6 Security incidents. CIQRA notifies the Controller under Section 8, without undue delay, where possible within 24 hours and at the latest within 72 hours, after becoming aware of a security incident affecting Merchant Personal Data subject to the LGPD, stating, as far as known: the nature of the data affected; the categories and approximate number of titulares; the technical and security measures in use; the risks; the measures taken or proposed to reverse or mitigate the effects; and, if the notification was delayed, the reasons. CIQRA supplements it as information becomes available and helps the Controller prepare its communication to the ANPD and to titulares, which the Controller must make within the period set by ANPD regulation (Resolution CD/ANPD No. 15/2024). The Controller keeps its own record of incidents.

15.4.7 Liability. Section 12 applies. Under Article 42 LGPD, CIQRA is liable together with the Controller only where it has failed to comply with the LGPD obligations that apply to operators or has not followed the Controller's lawful instructions; a party that compensates a titular has a right of recourse against the other to the extent of the other's share of responsibility (Article 42, paragraph 4 LGPD). Nothing in this DPA limits the rights of titulares under the LGPD.

15.5 Türkiye

15.5.1 CIQRA is established in Estonia and hosts Merchant Personal Data in the European Union (Microsoft Azure, Germany). The sub-processors and their locations are those in Annex III. This DPA and the EU SCCs incorporated by Section 11 are CIQRA's data-processing terms; CIQRA offers no other data-processing or transfer document.

15.5.2 Where the Controller is established in Türkiye or Merchant Personal Data relates to individuals in Türkiye, the Controller is solely responsible for its obligations under Law No. 6698 on the Protection of Personal Data ("KVKK") and its secondary legislation, including: the legal basis for transferring Merchant Personal Data abroad under Article 9 KVKK and any standard contract, consent, undertaking, permission or notification that basis requires; registration in the Data Controllers' Registry (VERBİS) where required; information notices under Article 10 KVKK; data subjects' applications; and notification of data breaches to the Personal Data Protection Board and to data subjects.

15.5.3 CIQRA does not sign the standard contract announced by the Personal Data Protection Board, or any other KVKK-specific contract or undertaking, and does not make notifications to the Board on the Controller's behalf; CIQRA states this before the Controller accepts this DPA. The Controller is responsible for determining whether, and on which basis under Article 9 KVKK, it may use the Services for personal data subject to KVKK, and for the consequences of that determination; it does not rely on CIQRA for it. Sections 6, 7 and 8 apply to Merchant Personal Data subject to KVKK in the same way as to other Merchant Personal Data, and the information in Section 8 is given so that the Controller can meet its own 72-hour notification duty.

15.5.4 Nothing in this supplement is an acknowledgment that KVKK applies to CIQRA directly, and nothing in it extends CIQRA's obligations beyond this DPA.

16. Disputes

Section 15 of the Terms of Service applies to every dispute arising out of or in connection with this DPA, including Section 15.5 for a Merchant established in the United States; this DPA does not depart from it. Where the SCCs, the UK Addendum or the ANPD Clauses require a particular governing law or forum for a claim brought under them, that requirement prevails for that claim only, and Section 15 of the Terms of Service applies to every other claim between the parties.

Annex I — Description of the processing

A. Parties

  • Controller: the Merchant, as identified in its account. Role: controller of the personal data of its Shoppers and users. Where Module Four of the SCCs applies (Section 11.1), the Merchant is the data importer; where Module Two is adopted under Section 15.2.2, it is the data exporter.
  • Processor: CIQRA OÜ, Veskiposti tn 2, 10138 Tallinn, Estonia · info@ciqra.com. Role: processor providing the e-commerce and content-management platform and CIQRA Pay. Where Module Four applies, CIQRA is the data exporter; where Module Two is adopted under Section 15.2.2, it is the data importer. For Module Three, the parties and their roles are stated in the annexes of the agreement between CIQRA and the sub-processor concerned.

B. Description of the processing

  • Data subjects: the Controller's Shoppers and website visitors; the Controller's staff and users; recipients of the Controller's marketing communications; authors of reviews and other user content.
  • Categories of personal data: identity and contact data (name, email address, telephone number, postal addresses); order and transaction data (items, amounts, order history — excluding full card numbers); account credentials (stored in hashed form); communications and support data; marketing preferences and consent records; device, usage and log data and online identifiers; user-generated content; and any further data the Controller chooses to collect through its Storefront.
  • Special categories of data: not intended to be processed. If the Controller configures its Storefront to collect such data, it does so under its own legal basis and responsibility.
  • Frequency of transfer: continuous, for the duration of the Services.
  • Nature and purpose of the processing: hosting, storage and display; order processing; search and recommendations; transactional and marketing communications on the Controller's instructions; analytics as configured by the Controller; AI-assisted features where used; and platform operation, security and support.
  • Duration: the term of the Services, plus the retention, export and deletion periods in Section 9 (data of a closed store is deleted 2 years after closure; financial records are kept for 10 years after closure) and any other period for which the law requires retention; for a Controller on an Enterprise plan, Section 9.6 applies instead of the 2-year deletion.
  • Transfers to sub-processors: as described in the Subprocessor List (Annex III).

C. Competent supervisory authority: the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), without prejudice to the competence of the Controller's own supervisory authority.

Annex II — Technical and organisational measures

  • Tenant isolation: each Merchant's data is separated by database row-level security, with the application connecting through a role that cannot bypass it; tenant scoping is applied to every query, and automated cross-tenant isolation tests run before changes are released.
  • Access control: authentication with role-based access control, multi-factor authentication for privileged access, least-privilege access and binding of access tokens to tenants.
  • Encryption: TLS for data in transit; encryption at rest on the hosting platform; per-tenant data-encryption keys wrapped by key-encryption keys held in Azure Key Vault.
  • Payments: PCI DSS SAQ A scope — full card numbers are captured by Stripe and never reach CIQRA's systems.
  • Data location: hosting, compute, database, storage and key management on Microsoft Azure in Germany (Germany West Central), with geo-redundant backups in Germany North; AI processing on EU Data Zone deployments (Germany West Central and Sweden Central); the redirect service for Storefront apex domains in Sweden Central.
  • Monitoring and incident response: centralised logging, metrics and error monitoring; rate limiting and account lockout; a documented breach-notification procedure.
  • Resilience: automated, geo-redundant database backups with point-in-time recovery (up to 35 days on a rolling basis); recoverable copies of deleted files (30 days); and, where kept (Section 9.4), protected long-term copies of the database and of stored files (weekly copies up to 8 weeks, monthly copies up to 6 months) in a separate backup store designed to prevent alteration or deletion before their period ends, with restricted access, encrypted, in Germany West Central with a geo-redundant copy in Germany North.
  • Secure development: code review, automated testing including tenant-isolation tests, and security review of changes before release.
  • Vendor management: sub-processors are engaged under written data-protection terms as described in Section 5.

Annex III — Sub-processors

The authorised sub-processors are listed in the Subprocessor List, which forms Annex III to this DPA; it is also the list of sub-processors for the purposes of Section 15.2.3 (UK Addendum, Table 3) and Section 15.4.3.